composer.lock versioned